CVE-2025-68324

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: imm: Fix use-after-free bug caused by unfinished delayed work

The delayed work item 'imm_tq' is initialized in imm_attach() and

scheduled via imm_queuecommand() for processing SCSI commands. When the

IMM parallel port SCSI host adapter is detached through imm_detach(),

the imm_struct device instance is deallocated.

However, the delayed work might still be pending or executing

when imm_detach() is called, leading to use-after-free bugs

when the work function imm_interrupt() accesses the already

freed imm_struct memory.

The race condition can occur as follows:

CPU 0(detach thread) | CPU 1

| imm_queuecommand()

| imm_queuecommand_lck()

imm_detach() | schedule_delayed_work()

kfree(dev) //FREE | imm_interrupt()

| dev = container_of(...) //USE

dev-> //USE

Add disable_delayed_work_sync() in imm_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References